16992 matches found
blog.mi-m.info Cross Site Scripting vulnerability OBB-2132030
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Cross-site Scripting (XSS)
Overview file-upload-with-preview is an A simple file-upload utility that shows a preview of the uploaded image. Written in pure JavaScript. No dependencies. Works well with Bootstrap 4 or without a framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS. A file...
CVE-2020-19048
CVE-2020-19048 : MyBB 1.8.20 is vulnerable to a Cross Site Scripting (XSS) flaw in the Add New Forum feature. An authenticated attacker can inject arbitrary script/HTML via the Title field when making a POST to /Upload/admin/index.php?module=forum-management&action=add, potentially affecting the ...
CVE-2021-32991
Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a user to carry out an action unintentionally...
CVE-2020-18125
CVE-2020-18125 is a reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5. The issue allows attackers to execute arbitrary web scripts or HTML. Evidence from connected documents confirms the affected product (Indexhibit 2.1.5) and the vulnerable ...
CVE-2020-18126
CVE-2020-18126 concerns Indexhibit 2.1.5 where the Sections module exposes multiple stored XSS vulnerabilities. The affected component is the Sections module within Indexhibit, version 2.1.5. The flaws allow attackers to inject and execute arbitrary web scripts/HTML in users’ browsers, via stored...
fukui-tenshoku.com Cross Site Scripting vulnerability OBB-2128416
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
tredition.de Cross Site Scripting vulnerability OBB-2127575
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-18913
CVE-2020-18913 affects EARCLINK ESPCMS-P8 with a SQL injection vulnerability in the espcms_web/Search.php component via the attr_array parameter. The issue allows attackers to access sensitive database information. Public details cite both CVSS v2 (base score 5.0, MEDIUM) and CVSS v3.1 (base scor...
CVE-2021-30851
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code execution...
CVE-2021-30952
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution...
Cross-Site Request Forgery (CSRF) in myvesta/vesta
✍️ Description Attacker is able to rename any file on the server if logged in user visits attacker website. 🕵️♂️ Proof of Concept Create a test.txt file under /home/user when you logged in open this POC.html in a browser you can check test.txt renames to test.php. //PoC.html history.pushState'',...
Simple Phone book/directory 1.0 - (Username) SQL Injection Vulnerability
Exploit Title: Simple Phone book/directory 1.0 - 'Username' SQL Injection Unauthenticated Exploit Author: Justin White Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/13011/phone-bookphone-directory.html Version: 1.0 Testeted on: Linux Ubuntu 20.0...
U.S. Dept Of Defense: Open Akamai ARL XSS on http://media.████████
The Reflected Cross-site Scripting XSS vulnerability was discovered on the http://media.████ website. The vulnerability allowed the execution of arbitrary JavaScript code by injecting it into the vulnerable URL parameter. The vulnerability was found to be present in the Akamai ARL Adaptive Delive...
The vulnerability of the Server Name Identification (SNI) component of the Cisco Web Security Appliance internet server, the micro-programming software for Cisco Firepower Threat Defense network firewalls, and the intrusion detection systems allows a malicious actor to gain full control over the compromised host and unauthorized access to protected information.
The vulnerability of the Server Name Identification SNI component of the Cisco Web Security Appliance internet server, as well as the micro-programming software for Cisco Firepower Threat Defense and the intrusion detection system Snort, is related to SSL handshake filtering errors. Exploiting th...
CVE-2021-27822
CVE-2021-27822 affects Vehicle Parking Management System 1.0, with a persistent XSS in the Add Categories module via the Category field. Root cause cited across connected sources as insufficient validation/escape of client-side data, enabling arbitrary script execution. Impact is described as rem...
CVE-2021-34749
A vulnerability in Server Name Identification SNI request filtering of Cisco Web Security Appliance WSA, Cisco Firepower Threat Defense FTD, and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from...
CVE-2021-34749
A vulnerability in Server Name Identification SNI request filtering of Cisco Web Security Appliance WSA, Cisco Firepower Threat Defense FTD, and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from...
CVE-2021-34749
CVE-2021-34749 affects Cisco WSA/FTD and the Snort detection engine. The issue stems from inadequate filtering of the SSL handshake in the SNI data path, allowing an unauthenticated remote attacker to bypass filters and exfiltrate data from a compromised host, potentially enabling command-and-con...